GOAP provenance: content-bound URL attestation with two-time (view + commit) binding and a post-quantum wrapper

Here is the status of my enhanced GOAP that builds upon yours and that we very briefly discussed on the HackerSpace call on 05-29-2026.

---

**Step 1 — URL + Hash concatenation for access time (src/main.ts)**

When `--fetch-urls` is passed, `fetchUrlsToFiles()` fetches each URL, strips HTML, computes SHA-256 of the first 8,000 characters of the text content, and records an ISO timestamp at fetch time. The 8,000 character limitation of the html-stripped text was for testing purposes and should be removed before publishing (`src/main.ts:687`, `.slice(0, 8_000)`). Each source becomes one line in the manifest:

`${url} ${sha256_of_content} ${fetchedAt}`

Example (from the actual `.tsa.json` artifact on disk):
`https://www.rfc-editor.org/rfc/rfc3161.html 2eb5d864... 2026-02-20T04:03:00.954Z`
`https://en.wikipedia.org/wiki/Trusted_timestamping 6c6e9cc5... 2026-02-20T04:03:01.061Z`

The entire multi-line manifest text is then SHA-256 hashed → `manifestHash`. This value is what the TSA timestamps.

The "access time" timestamp is baked here — the TSA's signed response proves the URLs were fetched at this moment.

---

**Step 2 — Sign with Trust certificate (TSA RFC 3161)**

`requestTsaTimestamp()` in `src/main.ts` runs:

`openssl ts -query -data -sha256 -cert -out `

Then POSTs to DigiCert (`http://timestamp.digicert.com`), with Sectigo as fallback. The TSA returns an RFC 3161 `.tsr` (timestamp response) with a DigiCert RSA4096/SHA256 timestamping certificate embedded. This is the "Trust certificate" — DigiCert's CA is the trust anchor.

The `.tsr` is stored as base64 in `.tsa.json`. An auditor can verify with:
`openssl ts -verify -data manifest.txt -in response.tsr -CAfile /etc/ssl/certs/ca-certificates.crt`

Confirmed live: TSA file `docs/research/Bunker-Strategy-v1.tsa.json` shows DigiCert signed at 2026-02-20T04:03:01.406Z.

(The 2026-02-20T04:03:01.406Z shown is the local request time recorded in the file; DigiCert's token carries `genTime` 04:03:01 GMT — the same second, give or take network latency between the two clocks.)

---

**Step 3 — EC signature via Sigstore/cosign (src/publish.ts, Phase 14, 2026-02-20)**

This is the "research finished" timestamp. After the document is written:

`cosign sign-blob --bundle --yes`

cosign uses GitHub OIDC → Fulcio CA issues a short-lived ECDSA (EC) certificate → signs the document blob → posts the entry to Rekor (Sigstore's public transparency log). The Rekor entry's `integratedTime` is the research-finished timestamp.

The "Trust certificate" here is the Fulcio CA chain embedded in the `.bundle` JSON. Verification is fully public:
`cosign verify-blob --bundle `

The Provenance & Verification block appended to the `.md` file records the Rekor log index and links to search.sigstore.dev.

---

**Step 4 — Quantum-resistant wrapper (src/pq-wrap.ts, Phase 14+, 2026-02-20)**

After both TSA and cosign steps, `pq-wrap.ts` applies an ML-DSA-65 (NIST FIPS 204, 128-bit quantum security) outer signature using `@noble/post-quantum`. It:

1. SHA-3-256 hashes the document, the `.tsa.json`, and the `.bundle`
2. Canonicalizes them as JSON with sorted keys
3. Signs with ML-DSA-65 secret key (derived from a 32-byte seed stored at `~/.ruvbot-pq.seed`)
4. Writes `.md.pq.json`

The wrapper binds all three layers (document + TSA access-time attestation + Rekor EC signature) into one quantum-resistant envelope. A quantum adversary cannot forge the outer signature to claim different content was attested.

Note: The TSA credential chain itself (DigiCert/cosign) is still classical RSA/ECDSA — full PQ requires PQ-capable TSAs (ETSI TS 119 312 migration, noted as in progress at DigiCert). This is explicit defence-in-depth.

---

**The two timestamps summarized**

| Timestamp | Where | What it proves |
|-------------------|--------------------------------------------|-------------------------------------------------------------|
| Access time | `fetchedAt` in TSA manifest, DigiCert-signed | URLs were fetched at this moment — source content is pinned |
| Research finished | Rekor `integratedTime` via cosign | The final document existed and was signed at this moment |

---

The source files (`src/main.ts`, `src/publish.ts`, `src/pq-wrap.ts`) and the live TSA attestation (`Bunker-Strategy-v1.tsa.json`) are available by email on request. Some companion artifacts that no longer verify because they were rendered obsolete by later code edits are omitted pending regeneration and verification anew.

If you have questions send them to me at john.howard.messing@gmail.com

Start by reviewing the referenced entry points in src/main.ts, src/publish.ts, and src/pq-wrap.ts, then inspect docs/research/Bunker-Strategy-v1.tsa.json and the existing verification commands. The issue does not define a focused change or acceptance criteria; completion would require an agreed scope and verifiable behavior for the URL manifest, TSA response, cosign bundle, and PQ wrapper.

Written by the indexing model from the issue text.